2ddd00ff4fd8bad6ae9e294ec5a138b5215a490b202ae06ecaa08f081078c26b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
Size

144KB
MD5

b49d1edaa163615a06da4f548d25bd00
SHA1

81d0b9ec3b44f7e72349d94ad57604f6b9c88921
SHA256

2ddd00ff4fd8bad6ae9e294ec5a138b5215a490b202ae06ecaa08f081078c26b
SHA512

5455f456e61cd8fd39d3b52a1050d09314e309f8f4f29e82b9d30eb1a7265fe43178209c8a68da0a8e7184e97ae027bea21ee4014ae480ee5ee7e5b622dec6e2
SSDEEP

3072:Np3ol6ne1FeDqubzvyTzdH13+EE+RaZ6r+GDZnBcVU:LokXDquPyTzd5IF6rfBBcVU

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mciobn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpfijcfl.exe

Executes dropped EXE 32 IoCs

pid	Process
4540	Lgkhlnbn.exe
2860	Lnepih32.exe
2296	Lpcmec32.exe
3364	Lcbiao32.exe
3980	Lilanioo.exe
1528	Lpfijcfl.exe
3624	Lgpagm32.exe
1324	Laefdf32.exe
1260	Lgbnmm32.exe
4900	Mnlfigcc.exe
812	Mciobn32.exe
5020	Mjcgohig.exe
2924	Mdiklqhm.exe
3280	Mkbchk32.exe
3064	Mnapdf32.exe
4544	Mdkhapfj.exe
5084	Mkepnjng.exe
1228	Mncmjfmk.exe
596	Mpaifalo.exe
5016	Mnfipekh.exe
1568	Mdpalp32.exe
728	Nkjjij32.exe
1716	Nqfbaq32.exe
3784	Ngpjnkpf.exe
3684	Nnjbke32.exe
3988	Nqiogp32.exe
1008	Ngcgcjnc.exe
3604	Nnmopdep.exe
4824	Ncihikcg.exe
2820	Njcpee32.exe
3476	Ndidbn32.exe
4556	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nnjbke32.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Lnepih32.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Ocbakl32.dll	Mciobn32.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Nqfbaq32.exe	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Lpcmec32.exe	Lnepih32.exe
File created	C:\Windows\SysWOW64\Kmalco32.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Bbgkjl32.dll	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Ebaqkk32.dll	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nnmopdep.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Kgkocp32.dll	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mjcgohig.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Lilanioo.exe	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Lgbnmm32.exe	Laefdf32.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Lgkhlnbn.exe	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
File created	C:\Windows\SysWOW64\Mnlfigcc.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Lifenaok.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Ciiqgjgg.dll	Mkepnjng.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Lilanioo.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Mnlfigcc.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Ockcknah.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Ndclfb32.dll	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
File created	C:\Windows\SysWOW64\Bidjkmlh.dll	Lgbnmm32.exe
File opened for modification	C:\Windows\SysWOW64\Mkepnjng.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Nnjbke32.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\Mnapdf32.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Laefdf32.exe
File created	C:\Windows\SysWOW64\Mjcgohig.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4908	4556	WerFault.exe	114

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ockcknah.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgkocp32.dll"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqcbapl.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifenaok.dll"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebaqkk32.dll"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majknlkd.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbakl32.dll"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mciobn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nngcpm32.dll"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bidjkmlh.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgpagm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4540	5100	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe	81
PID 5100 wrote to memory of 4540	5100	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe	81
PID 5100 wrote to memory of 4540	5100	b49d1edaa163615a06da4f548d25bd00_NEIKI.exe	81
PID 4540 wrote to memory of 2860	4540	Lgkhlnbn.exe	82
PID 4540 wrote to memory of 2860	4540	Lgkhlnbn.exe	82
PID 4540 wrote to memory of 2860	4540	Lgkhlnbn.exe	82
PID 2860 wrote to memory of 2296	2860	Lnepih32.exe	83
PID 2860 wrote to memory of 2296	2860	Lnepih32.exe	83
PID 2860 wrote to memory of 2296	2860	Lnepih32.exe	83
PID 2296 wrote to memory of 3364	2296	Lpcmec32.exe	84
PID 2296 wrote to memory of 3364	2296	Lpcmec32.exe	84
PID 2296 wrote to memory of 3364	2296	Lpcmec32.exe	84
PID 3364 wrote to memory of 3980	3364	Lcbiao32.exe	86
PID 3364 wrote to memory of 3980	3364	Lcbiao32.exe	86
PID 3364 wrote to memory of 3980	3364	Lcbiao32.exe	86
PID 3980 wrote to memory of 1528	3980	Lilanioo.exe	87
PID 3980 wrote to memory of 1528	3980	Lilanioo.exe	87
PID 3980 wrote to memory of 1528	3980	Lilanioo.exe	87
PID 1528 wrote to memory of 3624	1528	Lpfijcfl.exe	88
PID 1528 wrote to memory of 3624	1528	Lpfijcfl.exe	88
PID 1528 wrote to memory of 3624	1528	Lpfijcfl.exe	88
PID 3624 wrote to memory of 1324	3624	Lgpagm32.exe	90
PID 3624 wrote to memory of 1324	3624	Lgpagm32.exe	90
PID 3624 wrote to memory of 1324	3624	Lgpagm32.exe	90
PID 1324 wrote to memory of 1260	1324	Laefdf32.exe	91
PID 1324 wrote to memory of 1260	1324	Laefdf32.exe	91
PID 1324 wrote to memory of 1260	1324	Laefdf32.exe	91
PID 1260 wrote to memory of 4900	1260	Lgbnmm32.exe	92
PID 1260 wrote to memory of 4900	1260	Lgbnmm32.exe	92
PID 1260 wrote to memory of 4900	1260	Lgbnmm32.exe	92
PID 4900 wrote to memory of 812	4900	Mnlfigcc.exe	93
PID 4900 wrote to memory of 812	4900	Mnlfigcc.exe	93
PID 4900 wrote to memory of 812	4900	Mnlfigcc.exe	93
PID 812 wrote to memory of 5020	812	Mciobn32.exe	94
PID 812 wrote to memory of 5020	812	Mciobn32.exe	94
PID 812 wrote to memory of 5020	812	Mciobn32.exe	94
PID 5020 wrote to memory of 2924	5020	Mjcgohig.exe	95
PID 5020 wrote to memory of 2924	5020	Mjcgohig.exe	95
PID 5020 wrote to memory of 2924	5020	Mjcgohig.exe	95
PID 2924 wrote to memory of 3280	2924	Mdiklqhm.exe	96
PID 2924 wrote to memory of 3280	2924	Mdiklqhm.exe	96
PID 2924 wrote to memory of 3280	2924	Mdiklqhm.exe	96
PID 3280 wrote to memory of 3064	3280	Mkbchk32.exe	97
PID 3280 wrote to memory of 3064	3280	Mkbchk32.exe	97
PID 3280 wrote to memory of 3064	3280	Mkbchk32.exe	97
PID 3064 wrote to memory of 4544	3064	Mnapdf32.exe	98
PID 3064 wrote to memory of 4544	3064	Mnapdf32.exe	98
PID 3064 wrote to memory of 4544	3064	Mnapdf32.exe	98
PID 4544 wrote to memory of 5084	4544	Mdkhapfj.exe	99
PID 4544 wrote to memory of 5084	4544	Mdkhapfj.exe	99
PID 4544 wrote to memory of 5084	4544	Mdkhapfj.exe	99
PID 5084 wrote to memory of 1228	5084	Mkepnjng.exe	100
PID 5084 wrote to memory of 1228	5084	Mkepnjng.exe	100
PID 5084 wrote to memory of 1228	5084	Mkepnjng.exe	100
PID 1228 wrote to memory of 596	1228	Mncmjfmk.exe	101
PID 1228 wrote to memory of 596	1228	Mncmjfmk.exe	101
PID 1228 wrote to memory of 596	1228	Mncmjfmk.exe	101
PID 596 wrote to memory of 5016	596	Mpaifalo.exe	102
PID 596 wrote to memory of 5016	596	Mpaifalo.exe	102
PID 596 wrote to memory of 5016	596	Mpaifalo.exe	102
PID 5016 wrote to memory of 1568	5016	Mnfipekh.exe	103
PID 5016 wrote to memory of 1568	5016	Mnfipekh.exe	103
PID 5016 wrote to memory of 1568	5016	Mnfipekh.exe	103
PID 1568 wrote to memory of 728	1568	Mdpalp32.exe	104

C:\Users\Admin\AppData\Local\Temp\b49d1edaa163615a06da4f548d25bd00_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\b49d1edaa163615a06da4f548d25bd00_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\Lgkhlnbn.exe
  C:\Windows\system32\Lgkhlnbn.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\Lnepih32.exe
    C:\Windows\system32\Lnepih32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\Lpcmec32.exe
      C:\Windows\system32\Lpcmec32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3364
      - C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1528
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:596
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:728
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1716
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3784
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1008
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3604
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3476
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        33⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 420
        34⤵
        Program crash
        
        PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4556 -ip 4556
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Kgkocp32.dll

Filesize
7KB

MD5
557967b442efb4981059fc99435f1363

SHA1
71cf4e981123b070d2a4beff2b8f2249d23e1243

SHA256
130c9779f9c1729534e8a868c3d8e23ea1b218eafbd8bba76398e23c0e562c6a

SHA512
094bb0bcba5e52fc207beb646716fff5826526ad2f343a98fd8c8ee3d1b2ce73aa696fe432d06b95f84422d2e27af913be7eeb8bba223bbf0d8b85c4739a1c20

Download Submit
C:\Windows\SysWOW64\Laefdf32.exe

Filesize
144KB

MD5
80269fd88d0d74d8bfd1648f500902ca

SHA1
1a7d43414f0f40ba3e92e915fe3aaa8786135d7d

SHA256
5a7dcd0af4b090f6af90e97064df0114639539deee399e54d74621a4cfee988b

SHA512
e12e8d5dfc042dc206209f48c589215b539f8cf54c8ff81e6c906596b18ab037c2affdc74f18fcd1aca85c2b89d07d8135861d0a140d34ac6b460f311f411578

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
144KB

MD5
f335573b243485c64723e1854db0a11b

SHA1
045de162d9f613c770125dfc585dcd547cd5b7e0

SHA256
4009c45de0ecc34e0e354d8fca97fe81f7b42cebaa10a945f685688c75370485

SHA512
87e0ae607fedd4e5090558aaaa43670736bd6d17fd3a55a750d4286bdb1d2fd20e14b2b8f4b51302ddccd260bec2e76f1f9050131f54a609d26b91f0ec70151e

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
144KB

MD5
3d3c67f4e523aa7a58a9656e9063909c

SHA1
3ada786835cdf5305adf11385b3683f8f6c863a1

SHA256
14b4dd8b1affb57716d7348bbb4ef9510bdff511cf954192f9467049f84c337e

SHA512
0881d235829da98a8adcd73ba7c8b0cb8247260ef4d95613f9f037139bbe0d36b13109d25c2a6a94d3bc29b9a4ae8477ae81d0e76e64e3cc8817066ffde4a0a5

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
144KB

MD5
bbf2be822032447372ac5e9709bd2964

SHA1
ce711149e5d70c1496b0fd1550f2a62fd3d80797

SHA256
50513f2386b548c640b6754709afbdf2c80df46406d1afdc887893936714eeae

SHA512
e90fd247ecc9adfe5dd81fbe05fc5ee9f10dd31fd7202aaaae14bfa7047d8162bc89b9d4584690c3d67a1a0cc53508ac0d61625eb9c39c07961e928b3fb7da2f

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
144KB

MD5
5600c2bb4050dcedee1b3cb514512286

SHA1
77c904308999cb4ee747fb26f575bab94344e6f8

SHA256
e1c19a4f9f0645d50df9c96f50d47120c0a83cf20dee2b11516588079cd6424e

SHA512
ac38ff6bf901631b0f5f4aff4fdc70984f96db48b6826d8d61ae2cfbc229875d6145ff1bcaecf80b080a0fcc990f9ef7d342def336267c7b076764e71eec4cf3

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
144KB

MD5
fc4266631ea21e7a5b1d9386fdb47c42

SHA1
606befd9166d6f17bae8c7f0c5fceaae73290a3d

SHA256
2b5561a6c667249f740b9dbf350592d1e3a927b2c00d053e314f3561b5025a51

SHA512
ffec109be05f26924e8c1bfdbc128c61a8b480ad49a7959c7726efe1ec73ac57f181f6b3a5bfb67d4d73dd17309797afdced91131c0b059e1dfb48e12bea19d6

Download Submit
C:\Windows\SysWOW64\Lnepih32.exe

Filesize
144KB

MD5
f37b888f790bbf83554943a170b7546d

SHA1
4d5920980e54588fb9a72f117dd03326f35a7d06

SHA256
6a7855038ea52fa0d224297013f3f30f3a4aa9a1cf5027e93472d7646b4b40fa

SHA512
286eb3ff943c25cc1d42ab7be0d2b867c6fc84609ccaab6572de004c5006a623f6626195eebb81f4e7096d6fc17f95a2f7cc7dd02efabe67409ca5653a027adb

Download Submit
C:\Windows\SysWOW64\Lpcmec32.exe

Filesize
144KB

MD5
46dce6452bb6b8571124d8065bf44c73

SHA1
e752c37e5d301a1206a26df0e1fe306229f2519c

SHA256
e7dee2934b704188c2ef6a9ebf8c395ea264debe9902e3426c5cc0ec19ad01d7

SHA512
a8c6b590a8717dadde8a05986c7291298e1fe6847be5d464cac3a45d36c4e18c99cfb06dc9868328b39de29e5bd934bf20d76048baefb933705b883c878d6c41

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
144KB

MD5
565bd61721fa3aced7ed8ae23aad4c8f

SHA1
e5cb61c0911f9ac29f04f1297530c29edf5a4c76

SHA256
131042eec9347cf3e85ed550e32ed2c73757bb9c69a275cc965903e3ae8f9bd9

SHA512
0dcadfa21d8de6ee2626e071acd3db60189e1e86d5ecf4b91af2a339628d48b461dcf00e97b117dbbe137955ef3092785d0177b533093f7d3f55433df3034893

Download Submit
C:\Windows\SysWOW64\Mciobn32.exe

Filesize
144KB

MD5
f66c20aa07264575db62fcb0c47b0311

SHA1
ca653590a784730c753af951856d8c6e94cec37d

SHA256
72b8bc8caf88c76f2aa8c2cf3a9fde82234d256b001fe9cdbe32aa5aca55eefa

SHA512
cb2981d493ccd3b79b87a4a4192935fe0913798d6671db3168385f37c8bb596588be3718b719a1ec8504f12c52d9e82d1c6f830cb9b913b962a89d478d97ad67

Download Submit
C:\Windows\SysWOW64\Mdiklqhm.exe

Filesize
144KB

MD5
50e66ab3c66f4baba0fc6b745daa6e54

SHA1
7d0ebf3a37c1c9f985092526a7714ea505864035

SHA256
beab30690d24c3687e9fe584cd002580177dcf555ea515bb602a2269e797bb54

SHA512
60783319f8d61a035d0d7e05f5443c5989dfa89d80fbbbcee12ced0aec039fff950f696409acd7a04be519838e7b4e6a3da7ddedd58b6b16a258da51fc7a120e

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
144KB

MD5
633063017fb965a25a15f9d036130f80

SHA1
ff8278a165751b1c3e303b019aaf6a21858a3342

SHA256
87986a986a8f08b8550a4c1f32e1fb5497edbb3dcaba6f7c300febdbedc6a39b

SHA512
393cdf9bfea3bcf7b99cf9040603eb875b14be8b35e73d65579f33cd492285af9e3d376fcfba99674a0d74f66943c0e43b856b85856a59e7696950653d5c9438

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
144KB

MD5
b9ffd6aa50b41f7221b418f6e52782aa

SHA1
a16c49dbccdb8c35cd5549164f48e679c55b1883

SHA256
9281a2785a7c931a3746e5c3488c6eace7b07efd6c4115d9bf1279da6dc6883d

SHA512
db1781e02507940df160b0194dc61390dafb79b2bc2ba453fc1a6a66815e7be7a21e188ee1a3b48b328d4e4d4c525a851f095736e84035130d981f2f43ea2c51

Download Submit
C:\Windows\SysWOW64\Mjcgohig.exe

Filesize
144KB

MD5
69c5550fea572ac4248f8c4231eb325a

SHA1
9d94c57049af211394c620b1bd56febd881d9268

SHA256
286617c35c50044fce0cf0289aa8f2646df3b4f1d3d190ba3e7d1d884bf8acd0

SHA512
b0ebb567a34b5f78fb95197c61ac3030d7c1c615859465108338f43cebae1e73959da43e190d091efbeb006d704702e17c27ddc27f79732f5f878afe45439680

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
144KB

MD5
017a37e110dc8cd053b0fd81fec2d47a

SHA1
114bcf344c0c9c4abb3ef6e58f666a03f058905d

SHA256
2554160053f9eda08c109ed540d862e994873c56e27edd1645ebac8a40aec1c3

SHA512
3d62c9e5cfec74558734ea3a43897b4786a864787220b50397ea4326e37b39eb45e5efc40b0d1a949e1322fd56733003105e04ff33ae3c11453bf5e73c00a625

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
144KB

MD5
274fb614801273fd4258430b0f0ba0ea

SHA1
caea78b2225186552951000326283ababbc2b305

SHA256
247c61a8870e3bc7339ac6993079a6ef0194b0411d11da5b63cfecdf2af10d55

SHA512
3f9614e40180e4607e158a67b089b5b842e982de17854030eb25c9f6bd32b390c03df4a9c805ff4e13f6cc0d9e18228ac60b6483743f07d7a6e7838f59fdf03c

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
144KB

MD5
816f2fa1a4f1d3a78c205364e306ed46

SHA1
65f05d4055271f3636e0afeaa1a6d1b6ba53bc3e

SHA256
35217a21df220016749fbf3e57e742b87ef68fc420798142987e17d61344eb50

SHA512
2fb28239833c0751a2bb91056db3cfb526e18bfbe87c64cdc607eecdd7873f09947688bd53451947c820af1d63e7a0606f586dae554fc4608e24c379c90847a1

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
144KB

MD5
79071ad223c78703d1f450407b395c43

SHA1
4450a128c9748729fffa6cb68e7a050caa037e2c

SHA256
f133dfca7dd041a7335a2ee722d99e560700632133a415e39c65a804f65e1f44

SHA512
29df61ac055125d84f8cf45e428218a2b3341765bff1a3b9eefc482194d33e10f854e9706ac649623bff3d45e4dbd5d7f1665edb090a6453e73dc86bfd75e54b

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
144KB

MD5
6ffef52e877d46f0018a3fa334a4e918

SHA1
6c452c3774ea5882428d77db5518bb9820f29e84

SHA256
ba8174b5e335af0ed323ad00b4a32af19d0f79b982abb92e710dc5f5ad926cd1

SHA512
3cf0c41cb97e5452bea95105115ad8d01b00d3d8f0a0f86cb7df209bc26d071bcd8dc8b2ffba1d6487387a84aef95c9434c0764b32a097aeb03e28ea689377e5

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
144KB

MD5
9d8bd098b9eeddcc5a1f56f6ba3fc020

SHA1
badd282c1c592c5fa1e772a221d0266a203c72bf

SHA256
25956cbca2594c945c6570e8afe58c264106f744f83ac1d30238823e04e3bd87

SHA512
bc22f95778cb8cc7388f04dd657e229ecdd67e2b4cd277c55ed226c6f4cf3f6c362dee3ba190d6abc72016da75aaadb55e8285cd15604072ea2ee73f9d10ab0d

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
144KB

MD5
135a0754f9c51c9df129018ddf5c228d

SHA1
8e6298242d66b9a848720050341d823001da384a

SHA256
5bf1019faef9aa56edf8e9e8c65788df09f218e965c8d87c3196f8aedf028939

SHA512
492b186c449f5420b46d473956446e29a8f85f29f773dcbbb681a15e8a2244cf8c4224d32a5228e6f07169ead371af764ebdc024cea12f4a134aaff9e5d11db3

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
144KB

MD5
45fc898e8fe81a79df4e3c8be1f82f9b

SHA1
39df38efda139a927ae50e3cdf0d8478a5732e13

SHA256
ee5e2a4a1e87368ee11b8066a6fb4fb6b5fcb036acaaf03ee6e122d0d25aa75d

SHA512
88f61b88772e71dddbf02a44fce4cdd549f0ad7d372ba11ed8982d06df96def04145e14e1405a6178e561bda2cc11a25e1fbc357fe042b547d49d594ebb5e9f9

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
144KB

MD5
878cab27188756510104f3a37360c3ac

SHA1
60bf0e5400ca406a294b49a712085543209820fd

SHA256
3278b5f99ca36de09750cfc46215c6f79458be1bf2c9dc8b094672875a6a44e5

SHA512
a0128589e5a783df40acac811aa6c1506ea1a0c07ea1b4b7b4d31e3fcda24e64b03191c12b8d40da4ca17ee2b159acfca4f5e3113743160c3fd47302363dfe8e

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
144KB

MD5
a6ab321473fcff7a33678410611aa52b

SHA1
0f44385cd279778178d4bdd286d91263269ec336

SHA256
813082efa7a80368bb25422eaf19f508f0133e6d0514e9306de37531b9417390

SHA512
8eed09bbc4b92055adb558ab12abab983a18d440b301366c3182621654450069cc3d6c2be61a1d5bea9f456f3d03800fe75b22779bb1ef98bece1bb8d7c8a4fa

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
144KB

MD5
c275af513d47257a49167c34c17265ed

SHA1
36219bd784a8dbdc3a995ad5b721f43ee23a0b70

SHA256
ec6cb9be9ceab904729285b2adfeab5a8dea724ab4a8b962b80a29c5a3359465

SHA512
42fc9d13dcd0fd9d03415971a6569ae8e75f8487dbf4c237b78f82e8b6ead8f12ee7d81b57b395b87783a8084a2fb2a2763bff67d9f34ba87d41a98a7a7ac911

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
144KB

MD5
1eb4c39ad1b5530726fcaf1e2e80a7d5

SHA1
9ced1c7162ee06903c87d7f95638f0d9756fb09d

SHA256
531a5ebb8cfbc2ab4bea12c1df3ae9c32a836550b166f718e0a2c93fd9d90b85

SHA512
b4914f2c3241cda56e9fbe735314e3c284f51a2e5f43ac4e0bdee578eb16adbe1167908887280a0c9a5fdbd521b088c06e42904436c7683abd60e1395e448cfb

Download Submit
C:\Windows\SysWOW64\Nkcmohbg.exe

Filesize
144KB

MD5
f29aa24762b713b2f7dc7d49a36d4d75

SHA1
6e5c28d8b09c9ee3105526fb127f623b99be5511

SHA256
899f3cd41062a909b0ed91f6e9c980212376e393eae9b77d3bb4ac110b7cf7b3

SHA512
6f32eac2b3e3ce18806308730c0093dbde3e5639fade60624e37efa40bd952f9e7a56f796c6a82eeafa7ae6128061ab4822eb7022a3c9457c6722364b6073f02

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
144KB

MD5
c4cd52a7023759fec1798aa52f5e195c

SHA1
0c2433541ae4667531d149e6332bbe3293f95ee2

SHA256
daa2008a37d37d49d80b4425e5e88b95c718a6f1c1583374c40de008d7849f46

SHA512
56a188a54c75d41ca24940add83cd697b8b5863ac9307f58be22ea92a4e94f36a6e8ec20773a31a3fc32e8f9bcd32759f94626d9851568022e519cdfa596859f

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
144KB

MD5
b8a9cb6fec82f37467b253217e1ca895

SHA1
d543a17399bb800f9ade5cb2b258ea6f214490c6

SHA256
a2cd6810693ad230c1a2ae7dcc79355c6f1d227fd2fa3a8e28f4f44fecae05d2

SHA512
ab8bc2267b18c8984a7713c5da2bca1070889196054233b764d6a70e57628ec7cbdd39f0660aa18e77086394f835ed93bd5786c96f249bcd020cf31148e01c59

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
144KB

MD5
57fee6da6808d03ecb00262da0b4c186

SHA1
8ab720b0c5fae914d8bbdbf8c91e32bd973cb1d1

SHA256
4da51058703af9470d53cf9e659834cbed81371ef6af02aa5dba2f5031bc87be

SHA512
56c9aa02df574f131506a24ab7ee8dac02a49d0ad9f3ccddb77aab3b4a85dd8401e665ff2ce62175f93bbe576d2de9a544cfb6ca336b9081c453713ce788ba16

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
144KB

MD5
9e674b363708f1708aec9922b297bc63

SHA1
3acc5275dab9ed360bf88a1e3b8b39406b509c13

SHA256
e2798fa57706bfe6060a07455a0b403f71a16c0b35a7cecce34ea37f97634008

SHA512
f69628dcbf106b5cebb048c2f116b1f2f2dca680e6580cc13609a3f2a21544d1ba13b46e71e127d125c8e0a44ebf03ad44ce33acb730f66151f8aa2e3e152af9

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
144KB

MD5
d58dded20b1bc47d6444a92808589f26

SHA1
982283edbcfc9e7f6b8fbe9dda12519bf5cc49a7

SHA256
0fc852c4e06fd8fef14246f018c262592479016ba3c051c50eb5efc8462ce86f

SHA512
528961774f7b160b831037fb721226e370f1bbccf1233c69360e5847982097fb726a4818ff254eebfe4e7709210f154b746414f2342d7abcfe745d5fcbcd6a72

Download Submit
memory/596-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/596-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/728-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/728-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/812-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/812-297-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1008-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1008-267-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1228-284-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1228-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1260-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1260-301-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1324-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1324-303-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1528-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1528-307-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-278-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1716-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2296-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2296-313-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-261-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2860-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2860-315-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2924-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2924-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3064-289-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3064-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3364-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3364-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3476-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3476-258-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3604-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3604-265-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3624-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3624-305-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3684-271-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3684-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3784-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3784-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3980-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3980-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3988-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3988-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-287-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4556-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4556-259-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4824-263-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4824-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4900-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4900-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5016-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5016-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5020-295-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5020-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5084-141-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-319-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads